Thursday, December 31, 2015

from the fourth-amendment...-we-hardly-knew-ye dept

More documents have been uncovered (via FOI requests) that show local
law enforcement agencies in California have been operating cell phone
tower spoofers (stingray devices) in complete secrecy and wholly
unregulated.

Sacramento News10 has obtained documents from agencies
in San Jose, Oakland, Los Angeles, San Francisco, Sacramento and
Alameda County -- all of which point to stingray deployment. As has been
the case in the past, the devices are acquired with DHS grants and put into use
without oversight or guidelines to ensure privacy protections. The
stingrays in use are mainly limited to collecting data, but as the ACLU
points out, many manufacturers offer devices that also capture content.

Some of these agencies have had these devices for several years now.
Documents obtained from the Oakland Police Dept. show the agency has had
stingrays in use since at least 2007, citing 21 "stingray arrests"
during that year. This is hardly a surprising development as the city
has been pushing for a total surveillance network for years now,
something that (until very recently) seemed to be more slowed by contractor ineptitude than growing public outrage.

The device manufacturer's (Harris) troubling non-disclosure agreement
(which has been used to keep evidence of stingray usage out of court
cases as well as has been deployed as an excuse for not securing
warrants) rears its misshapen head again, mentioned both in one obtained
document as well as by a spokesperson reached for comment. One document
states:

"The Harris (REDACTED) equipment is proprietary and used for
surveillance missions," the agreement reads. "Its capabilities can only
be discussed with sworn law enforcement officers, the military or
federal government. This equipment's capabilities are not for public
knowledge and are protected under non-disclosure agreements as well as
Title 18 USC 2512."

The Sacramento County Sheriff's Dept. had this to (not) say when asked about its stingray usage:

"While I am not familiar with what San Jose has said, my
understanding is that the acquisition or use of this technology comes
with a strict non-disclosure requirement," said Undersheriff James Lewis
in an emailed statement. "Therefore it would be inappropriate for us to
comment about any agency that may be using the technology."

Law enforcement agencies are conveniently choosing to believe a
manufacturer's non-disclosure agreement trumps public interest or even
their own protection of citizens' Fourth Amendment rights.

The devices aren't cheap, either. Taxpayers are shelling out hundreds of
thousands of dollars for these cell tower spoofers, and the agencies
acquiring them are doing very little to ensure the money is spent
wisely. ACLU's examination of the documents shows that many of the
agencies purchased devices without soliciting bids.

It's hard to know whether San José or any of the other agencies that
have purchased stingray devices are getting good value for their money
because the contract was "sole source,"
in other words, not put out to competitive bidding. The justification
for skirting ordinary bidding processes is that Harris Corporation is
the only manufacturer of this kind of device. (We are aware of othersurveillancevendors that manufacture these devices, though a separate Freedom of Information Request
we submitted to the Federal Communications Commission suggests that, as
of June 2013, the only company to have obtained an equipment
authorization from the FCC for this kind of device is Harris.)

With Harris effectively locking the market down, buyers are pretty much
ensured prices far higher than the market would bear if opened to
competition. (Not that I'm advocating for a robust surveillance device
marketplace, but if you're going to spend taxpayers' money on products
to spy on them, the least you can do is try to get the best value for their
money…) Using federal grants also allows these departments to further
avoid public scrutiny of the purchase and use by circumventing the
normal acquisition process.

Beyond the obvious Fourth Amendment concerns looms the very real threat
of mission creep. These agencies cite combating terrorism when applying
for federal funds, but put the devices to use for ordinary law
enforcement purposes. The documents cite stingray-related arrests, but
since so little is known about the purchase, much less the deployment,
there's really no way to tell how much data and content totally
unrelated to criminal investigations has been collected (and held) by
these agencies.